Clock Drift and TOTP describes a common login problem: an authenticator app produces a six-digit code that a website refuses, even though the code looks correct. The cause is often a small disagreement about the current time between your device and the server checking the code.
Time-based one-time passwords depend on both sides sharing a nearly identical clock. When one clock runs slightly fast or slow, codes stop matching. This article explains how that works, why it happens, and how to correct it without weakening your account protection.
Why a Six-Digit Code Depends on the Time
A time-based one-time password, usually shortened to TOTP, is a short numeric code generated from a shared secret and the current time. The secret is stored in your authenticator app when you enroll, and the website keeps a matching copy. Each side runs the same calculation to produce a code.
The current time is divided into fixed intervals, most commonly thirty seconds. Within one interval, both devices produce the same code. When the interval changes, a new code appears. This is why codes refresh on a regular rhythm.
Because the code is derived from time rather than sent over a network, your phone and the server must agree on what time it is. If they disagree by more than a short window, the server sees a code that belongs to a different interval and rejects it.
What Clock Drift Actually Means
Clock drift is the gradual difference between a clock and the true time. Every computer and phone keeps time with a small internal crystal oscillator, and no oscillator is perfectly accurate. Over days or weeks, small errors accumulate, so the device clock slowly moves away from the correct time.
Drift is normal and usually tiny. Operating systems correct for it by synchronizing with network time servers, which report the correct time over the internet. When that synchronization stops working, drift grows unchecked and eventually becomes large enough to break TOTP codes.
Drift is only one way clocks disagree. A device can also show the wrong time because its time zone or date was set manually, or because a battery-backed clock was reset. Any of these differences can cause the same symptom: codes that look valid but fail to log you in.
Common Situations That Trigger Time Mismatches
Several everyday situations can push a device clock out of step with the server. Recognizing them makes troubleshooting faster and helps you avoid the problem in the future.
- A phone or computer that has not connected to the internet for a long time, so it has not synchronized its clock
- Manual time settings that were changed by mistake or left at an incorrect value after a device was reset
- A device that was moved to a different time zone without automatic time zone updates turned on
- An older computer whose internal clock battery is failing and loses accuracy between shutdowns
- A virtual machine or emulator whose clock pauses or drifts when the host system sleeps
If you notice codes failing only on one device while another device works, compare the clocks first. The device that is out of sync is usually the source of the problem. Checking time settings is faster than reinstalling an app or re-enrolling your account.
How Servers Tolerate Small Differences
Most TOTP systems do not require perfect agreement. Servers normally accept codes from the current interval as well as a small number of neighboring intervals, which gives a tolerance window. This allows for ordinary delays in typing, network travel time, and minor clock differences.
The exact window size is chosen by each service and is not standardized in a single way, so you should not assume a particular number of seconds. Some services are stricter than others. The tolerance exists to balance convenience with security, since accepting too many old codes would widen the period in which an intercepted code could be reused.
When your clock drifts beyond the tolerance window, the server cannot match your code no matter how carefully you type it. This is why a small correction to your device time often resolves the problem completely, while retyping the same code repeatedly does not help.
Checking and Correcting Your Device Clock
The simplest fix is to enable automatic date and time settings on your device. On most phones and computers, this option uses network time servers and corrects drift without any manual work. Look in the system settings under date and time, and make sure automatic setting is turned on.
If your device is already set to automatic, try restarting it while connected to the internet. A restart forces a fresh synchronization on many systems. Confirm that the time zone is also correct, since a wrong zone shifts the displayed time by whole hours and will break codes completely.
Some authenticator apps include their own time correction feature that compares your device clock against a server and adjusts the offset. Use it if it is available, but still confirm your system clock is accurate, because the app correction only helps within the app’s own calculations.
Clock Problems Across Different Platforms
Time handling differs between operating systems and between phones and computers, so the steps to check the clock depend on the device you use. Understanding these differences helps you find the correct setting quickly.
Phones and Tablets
Mobile operating systems usually synchronize time automatically through the cellular network and internet connections. If your phone shows the wrong time, the automatic setting may have been turned off, or the phone may have been offline for an extended period. Enabling the automatic option typically corrects the time within moments.
Phones that travel often are more likely to see time issues when moving between time zones or countries. Make sure the time zone updates automatically as well as the clock. Keep the device on a regular network connection now and then so synchronization can complete without interruption.
Some phones allow a separate setting for using network time versus carrier time. If codes fail after a trip abroad, check that the setting matches what your carrier provides. Restarting the phone after changing these options helps ensure the new values take effect.
Desktops and Laptops
Desktop and laptop computers store their clock using a battery-backed chip and synchronize with internet time servers when connected. Laptops that stay asleep for long periods may fall behind between sessions, so their clocks can need correction after waking. Look for an automatic time setting in the operating system date and time panel.
Computers that are rarely connected to the internet, such as some lab machines or air-gapped systems, can drift significantly over months. For these devices, you may need to configure a local time source or update the clock manually, depending on the policies of the organization that manages them.
A computer whose clock battery is failing may lose accuracy each time it powers off. If the time resets to an old default after shutdown, the battery should be checked or replaced by a qualified technician. Persistent time resets are a hardware sign, not just a setting problem.
Shared and Managed Devices
On shared or managed devices, time settings may be locked by an administrator. Users then cannot correct the clock themselves, and TOTP codes may fail without an obvious explanation. In these cases, the right step is to ask the device owner or IT support to check time synchronization rather than changing unrelated account settings.
Managed devices in schools and workplaces often rely on a central time server. If that server is misconfigured or unreachable, many devices can drift together, and codes may fail for several people at once. A pattern of simultaneous failures across many users points toward infrastructure rather than individual devices.
When you are unsure what policy applies, document the time shown on your device and the time shown by a trusted public time source, then share that information with the administrator. Clear evidence speeds up the fix and avoids guesswork.
Security Considerations When Adjusting Time
Correcting your device clock is a safe and expected fix, but you should understand why it works. Adjusting time to match the true current time restores the normal relationship between your device and the server. It does not bypass the second factor or reveal your secret.
Be cautious about widening the server tolerance window to make codes work. Some users ask support teams to accept older codes for longer periods, and while this can sometimes be justified temporarily, it reduces the protection that TOTP provides. Prefer fixing the clock to changing the verification settings.
Never share your TOTP secret or current codes with anyone claiming to help you fix a time problem. Legitimate support staff rarely need your code, and a request for it is a warning sign of a phishing attempt. Confirm any support instruction through the service’s official help pages.
Preventing Future Clock Problems
Prevention is simpler than repair. Keep automatic date and time enabled on every device that holds an authenticator app, and restart devices occasionally so they resynchronize. Avoid turning off network time synchronization unless a specific policy requires it.
Keep your operating system and authenticator app updated. Updates often include improvements to time handling and error messages. Also keep a backup of your authenticator recovery options, since time problems sometimes appear alongside device replacements and migrations.
Consider a quick check whenever you set up a new device or move your authenticator to it. Confirm the time and time zone match reality before enrolling. Doing this once avoids a lockout at the moment you most need access to your account.
Signs Your Problem Is Not the Clock
Not every failed code comes from time drift. Several other issues produce similar symptoms, and it helps to rule them out before spending effort on the clock. Use these checks if correcting the time does not restore access.
- The secret was entered incorrectly during setup, so the app and the server were never working from the same key
- You are reading from the wrong account entry in the app, especially if you use several services with similar names
- The code expired while you were typing, which happens when you wait until the last seconds of an interval
- The website account was changed or reset, and the authenticator entry no longer matches the current secret
- A temporary service problem on the provider side is affecting verification for all users
If none of these explain the failure, contact the service through its official support channel and describe the steps you have taken. Explain that you have checked your device time, but do not share your secret or live codes. Support can often verify your identity through recovery methods.
Practical Steps to Take Today
Start by checking the time and time zone on the device that holds your authenticator app. Turn on automatic settings if they are off, restart the device while connected, and then try a fresh code. Most clock problems resolve at this stage without any further action.
Next, review your recovery options for each important account. Save backup codes in a secure location, confirm that a second authenticator or recovery method is available, and record which services use your app so you know where to check if something fails later.
Schedule a brief routine check, perhaps when you change devices or update your system. A few minutes spent confirming the clock and your recovery setup keeps your second factor dependable, so your protection stays in place when you need it most.